We need to upload reports from a pod deployed on Kubernetes on Google Container Engine to a third party server that is protected by a firewall that enforce IP range filtering. Google’s IP range is dynamic (see here) so I cannot tell their operations team to simply open up a fixed IP range. How can we work around this?
Since VMs have static IPs over their lifetime, you could provision a "bastion" VM in your project and use it to tunnel your uploads:
This leaves the bastion as a single point of failure, so if you wanted some redundancy you could set up a few of them (in different regions).